Skip to main content
ARTICLE Toma Andrei Gabriel October 27, 2026 4 min read

PHP Security Updates: What They Mean for Your Website

PHP released urgent security updates this month. Here is what actually happened, who it affects, and the three questions every business owner should be able to answer.

If you run a business website, you may have seen headlines this week about PHP security updates. The wording can sound alarming. The reality is calmer, but there is a useful lesson in it for anyone with a website. Here is what happened, who it realistically affects, and what to check.

What happened

PHP is the programming language behind a large share of websites, including WordPress, many online shops and a lot of custom-built sites. Two things happened in the space of five days:

  • 21 October: the PHP project released updates (versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35) to fix two vulnerabilities it describes as critical. According to PHP, they could allow an attacker to run their own code on a server without logging in. PHP's advice was that all PHP users should update.
  • 26 October: PHP released rebuilt Windows packages to fix a separate flaw in Brotli, a data-compression library bundled with them. This one is tracked as CVE-2026-111497. According to PHP, it can only be reached when a site's server is set to automatically decompress responses it fetches from other servers. That setting is off by default, but some applications and software libraries switch it on.

The second item is what the news stories focused on. The first one is the one that matters to more people.

Who is actually affected?

It is worth being precise, because the two issues are different:

  • The Brotli fix (26 October) applies to PHP's Windows packages. If your website sits on ordinary Linux-based hosting, which is the most common setup for small business sites, that particular update is not aimed at you. The PHP announcement does not describe it as a Linux problem.
  • The 21 October fixes are broader. PHP says they affect PHP installations serving web requests, which is not limited to Windows. On Linux, the fixes usually reach you through your hosting provider or server vendor, who applies them.

In other words: you probably do not need to do anything technical yourself. But someone needs to be responsible for making sure it happens, and many business owners could not say who that is.

Why updates matter for a small business site

Vulnerabilities like these are found and fixed all the time. The risk is rarely the bug itself, it is the gap between a fix being released and a site actually receiving it. Sites that quietly fall behind are easier to target, and not just on PHP. The same applies to your CMS, your plugins and your theme.

Older PHP versions are a particular problem. PHP says that versions 8.1 and older no longer receive updates from the PHP project. Some hosting companies provide their own fixes for older versions, but you should not assume yours does without asking.

A five-minute checklist

  1. Which version of PHP is your site running? Your hosting control panel normally shows this. If it is 8.1 or older, ask your host or developer about upgrading.
  2. Who applies updates, and how often? Your host, your developer, you, or nobody? "I think my host does it" is worth confirming in writing.
  3. Is your CMS, theme and plugins up to date? Out-of-date plugins are a more common way in than PHP itself.
  4. Do you have a recent backup, and do you know how to restore it? A backup you have never tested is a hope, not a plan.
  5. Do you know who to call if something looks wrong on the site?

If you cannot answer two or more of these, that is a sign to put a simple routine in place.

How we can help

At TAG Web Design, our website maintenance covers plugin and theme updates, backups where your hosting supports them, security checks and emergency support if something goes wrong. If you are not sure what state your site is in, get in touch and tell us what it runs on. We will tell you honestly what we would check first. You can see what we offer on our services page.

No update routine can promise that a site will never have a problem, but a regular one removes the most common and avoidable risks.

Sources

This article is general information, not a security assessment of your website.

Back to Blog
KEEP READING

Related Articles